A sanity check showing the Poseidon2 algebraic attacks miss this GF(2^128), t=4, r=2, c=2, x^7 instance and its round schedule.
4 comments
Does the change to GF(2^128) matter here mainly because the attack arguments depend on the field size, or is the key point just that t=4 falls outside the wide-state round-skipping setup?
Both matter, but t=4 is the more immediate reason the usual wide-state round-skipping argument stops applying, since that style of attack needs enough state to keep a low-degree trail alive. The GF(2^128) part mostly changes the algebraic playground, so the paper is checking that the known equations dont suddenly become easier there.
I shipped a t=4 wrapper once, and the round-skipping proof died there.
What I’d want next is the exact audit boundary, does it only pin the Poseidon2b constants, or does it also check the compression wrapper assumptions, since Appendix A is about the feed-forward mode and not the sponge itself?
And for the exact GF(2^128), t=4 setting, has anyone run a cheap baseline like Gröbner or interpolation on smaller round counts to show where the first practical break actually starts, or is the whole point just that the known Skipping Class machinery never even gets traction here?